Commit 5f798bea authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: fix double prep iovec leak 



Requests may be prepared multiple times with ->io allocated (i.e. async
prepared). Preparation functions don't handle it and forget about
previously allocated resources. This may happen in case of:
- spurious defer_check
- non-head (i.e. async prepared) request executed in sync (via nxt).

Make the handlers check, whether they already allocated resources, which
is true IFF REQ_F_NEED_CLEANUP is set.

Cc: stable@vger.kernel.org # 5.5
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent a93b3331

fs/io_uring.c

+10 −2
Original line number Diff line number Diff line
@@ -2205,7 +2205,8 @@ static int io_read_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe, 
	if (unlikely(!(req->file->f_mode & FMODE_READ)))

		return -EBADF;



	if (!req->io)

	/* either don't need iovec imported or already have it */

	if (!req->io || req->flags & REQ_F_NEED_CLEANUP)

		return 0;



	io = req->io;
@@ -2293,7 +2294,8 @@ static int io_write_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe, 
	if (unlikely(!(req->file->f_mode & FMODE_WRITE)))

		return -EBADF;



	if (!req->io)

	/* either don't need iovec imported or already have it */

	if (!req->io || req->flags & REQ_F_NEED_CLEANUP)

		return 0;



	io = req->io;
@@ -2993,6 +2995,9 @@ static int io_sendmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) 


	if (!io || req->opcode == IORING_OP_SEND)

		return 0;

	/* iovec is already imported */

	if (req->flags & REQ_F_NEED_CLEANUP)

		return 0;



	io->msg.iov = io->msg.fast_iov;

	ret = sendmsg_copy_msghdr(&io->msg.msg, sr->msg, sr->msg_flags,
@@ -3143,6 +3148,9 @@ static int io_recvmsg_prep(struct io_kiocb *req, 


	if (!io || req->opcode == IORING_OP_RECV)

		return 0;

	/* iovec is already imported */

	if (req->flags & REQ_F_NEED_CLEANUP)

		return 0;



	io->msg.iov = io->msg.fast_iov;

	ret = recvmsg_copy_msghdr(&io->msg.msg, sr->msg, sr->msg_flags,

CRA Git | Maintained and supported by SUSTech CRA and CCSE